---
title: "Layer-Aware Representation Filtering — paper by Li et al. (2025)"
description: "The authors propose LARF (Layer-Aware Representation Filtering), which works in two stages: Finding… 60 references, cited by 9 papers here."
authors: ["Hao Li", "Lijun Li", "Zhenghao Lu", "Xianyi Wei", "Rui Li", "Jing Shao", "Lei Sha"]
year: 2025
venue: "Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing"
source: "https://aclanthology.org/2025.emnlp-main.406/"
doi: "10.18653/v1/2025.emnlp-main.406"
licence: "CC BY 4.0 (ACL Anthology)"
licence_url: "https://creativecommons.org/licenses/by/4.0/"
summary_licence: "Elamur Cosmic License"
canonical: "https://research.elamur.ai/free/en/papers/li-2025-layer-aware-representation-filtering-purifying/"
---
[Elamur Research](https://md.research.elamur.ai/free/en/) · [this page in HTML](https://research.elamur.ai/free/en/papers/li-2025-layer-aware-representation-filtering-purifying/)

[home](https://md.research.elamur.ai/free/en/) / [papers](https://md.research.elamur.ai/free/en/papers/) / [2025](https://md.research.elamur.ai/free/en/papers/2025/page/8/) / Layer-Aware Representation Filtering: Purifying Finetuning Data to Preserve LLM Safety Alignment

# Layer-Aware Representation Filtering: Purifying Finetuning Data to Preserve LLM Safety Alignment

**Authors:** [Hao Li](https://md.research.elamur.ai/free/en/authors/hao-li/), [Lijun Li](https://md.research.elamur.ai/free/en/authors/lijun-li/), Zhenghao Lu, Xianyi Wei, [Rui Li](https://md.research.elamur.ai/free/en/authors/rui-li/), [Jing Shao](https://md.research.elamur.ai/free/en/authors/jing-shao/) and [Lei Sha](https://md.research.elamur.ai/free/en/authors/lei-sha/) · **Year:** 2025 · **Venue:** [Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing](https://md.research.elamur.ai/free/en/venues/emnlp/) ([EMNLP 2025](https://md.research.elamur.ai/free/en/venues/emnlp/2025/)) · **Publisher:** [Association for Computational Linguistics](https://md.research.elamur.ai/free/en/publishers/association-for-computational-linguistics/) · **Licence:** [CC BY 4.0 (ACL Anthology)](https://creativecommons.org/licenses/by/4.0/)

**Links:** [Publisher's page](https://aclanthology.org/2025.emnlp-main.406/) · [PDF](https://aclanthology.org/2025.emnlp-main.406.pdf) · [DOI 10.18653/v1/2025.emnlp-main.406](https://doi.org/10.18653/v1/2025.emnlp-main.406) · [OpenAlex](https://openalex.org/W4416036695)

**Citations:** 2 citations (OpenAlex, 2026-10-14) · [9](https://md.research.elamur.ai/free/en/papers/li-2025-layer-aware-representation-filtering-purifying/cited-by/) in our library, of the 149,439 papers whose bibliographies we read

## Summary
Fine-tuning a safety-aligned LLM can weaken its refusal behaviour even when the training data look harmless. Standard moderation tools cannot catch such "safety-degrading" samples. Earlier detectors, such as gradient-based Bi-Anchoring and the trained ranker SEAL, are noisy or computationally expensive. The authors propose LARF (Layer-Aware Representation Filtering), which works in two stages:

1. **Finding the safety-sensitive layer.** Each layer's attention and feedforward weights are scaled slightly up and down. The layer whose scaling most changes the number of refusals on an overrejection dataset is selected.
2. **Scoring candidate samples.** At that layer, each sample's final-token hidden state is compared with average representations of harmful completions and safe refusals. The score is similarity to the unsafe centroid minus similarity to the safe centroid.

LARF needs no gradients and no extra training. Samples it ranks as risky sharply increase attack success after fine-tuning, while its safest picks keep the model robust. Removing flagged data reduced harmfulness on code, math and medical fine-tuning tasks with no loss of utility. This makes LARF a cheap audit step before deployment.

## Key points
- **Detection on Alpaca.** Fine-tuning Llama3.1 on the 1,000 samples LARF flags as most degrading raised HarmBench ASR from 3.5% to 39%, about 20% higher than with Bi-Anchoring's picks. The 1,000 safest-ranked samples gave 0% ASR.
- **Layer search.** Sensitivity is measured with scale factors α ∈ {0.1, 0.2}. Using both the unsafe and safe reference directions separated samples better than using the unsafe reference alone.
- **Downstream filtering setup.** Experiments used Magicoder (evaluated with HumanEval), PubMedQA and MetaMath (evaluated with MATH). For each dataset, 10,000 samples were drawn and 2,000 were removed. Safety was judged by GPT-4o on DirectHarm4.
- **Downstream results.** LARF was the only method that lowered harmfulness for every model–benchmark pair. Task scores stayed within 1% of a random-removal baseline.
- **Profile of flagged data.** Flagged samples tend to be long, point-by-point answers. Among Alpaca's flagged samples, 516–872 of 1,000 used this style (dataset average: 276), with roughly 330–354 output tokens versus 138 on average.

*Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.*

## Institutions

- [Peking University](https://md.research.elamur.ai/free/en/universities/peking-university/) — University, Beijing, China · 244 works · 39,359 citations
- [Shanghai Artificial Intelligence Laboratory](https://md.research.elamur.ai/free/en/labs/shanghai-artificial-intelligence-laboratory/) — Research institute, Shanghai, China · 117 works · 11,281 citations
- [Beihang University](https://md.research.elamur.ai/free/en/universities/beihang-university/) — University, Beijing, China · 65 works · 8,452 citations
- [Wuhan University](https://md.research.elamur.ai/free/en/universities/wuhan-university/) — University, Wuhan, China · 35 works · 1,127 citations

📚 Shelves (6): [🖥️ Computer Science](https://md.research.elamur.ai/free/en/shelves/computer-science/) · 16,667 works · [🤖 Artificial Intelligence](https://md.research.elamur.ai/free/en/shelves/computer-science/artificial-intelligence/) · 16,194 works · [🎭 Arts and Humanities](https://md.research.elamur.ai/free/en/shelves/arts-and-humanities/) · 16,039 works · [🗣️ Language and Linguistics](https://md.research.elamur.ai/free/en/shelves/arts-and-humanities/language-and-linguistics/) · 15,891 works · [🤝 Social Sciences](https://md.research.elamur.ai/free/en/shelves/social-sciences/) · 1,772 works · [🤝 Safety Research](https://md.research.elamur.ai/free/en/shelves/social-sciences/safety-research/) · 543 works

🧭 Topics (2): [🧠 Language models & pretraining](https://md.research.elamur.ai/free/en/topics/language-models/) · 3,320 works · [🛡️ Bias, fairness & safety](https://md.research.elamur.ai/free/en/topics/bias-fairness-safety/) · 517 works

## Cite

Cite as: Hao Li, Lijun Li, Zhenghao Lu, Xianyi Wei, Rui Li, Jing Shao and Lei Sha. 2025. Layer-Aware Representation Filtering: Purifying Finetuning Data to Preserve LLM Safety Alignment. Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing.

The paper itself, not this page. BibTeX from the library's record of the work.

```bibtex
@inproceedings{li2025layer,
  title = {{Layer-Aware Representation Filtering: Purifying Finetuning Data to Preserve LLM Safety Alignment}},
  author = {Hao Li, Lijun Li, Zhenghao Lu, Xianyi Wei, Rui Li, Jing Shao and Lei Sha},
  booktitle = {Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing},
  year = {2025},
  doi = {10.18653/v1/2025.emnlp-main.406},
  url = {https://doi.org/10.18653/v1/2025.emnlp-main.406}
}
```

- [← previous Is That Your Final Answer? Test-Time Scaling Improves Selective Question Answering](https://md.research.elamur.ai/free/en/papers/jurayj-2025-is-that-your-final-answer/)
- [next → Learning from Diverse Reasoning Paths with Routing and Collaboration](https://md.research.elamur.ai/free/en/papers/lei-2025-learning-diverse-reasoning-paths-routing/)
- [↑ back to papers of 2025](https://md.research.elamur.ai/free/en/papers/2025/page/8/)

## References

60 references, 22 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

1. Marah Abdin, Jyoti Aneja, Hany Awadalla, Ahmed Awadallah, Ammar Ahmad Awan, Nguyen Bach, Amit Bahree, Arash Bakhtiari, Jianmin Bao, Harkirat Behl, Alon Benhaim, Misha Bilenko, Johan Bjorck, Sébastien Bubeck, Martin Cai, Qin Cai, Vishrav Chaudhary, Dong Chen, Dongdong Chen, and 110 others. 2024. Phi-… — [Phi-3 Technical Report: A Highly Capable Language Model Locally on Your Phone](https://md.research.elamur.ai/free/en/papers/abdin-2024-phi-3-technical-report-highly/)
2. Andy Arditi, Oscar Balcells Obeso, Aaquib Syed, Daniel Paleka, Nina Rimsky, Wes Gurnee, and Neel Nanda. 2024. [Refusal in language models is mediated by a single direction](https://md.research.elamur.ai/free/en/papers/arditi-2024-refusal-language-models-mediated-single/). In The Thirty-eighth Annual Conference on Neural Information Processing Systems.
3. Mark Chen, Jerry Tworek, Heewoo Jun, Qiming Yuan, Henrique Ponde de Oliveira Pinto, Jared Kaplan, Harri Edwards, Yuri Burda, Nicholas Joseph, Greg Brockman, Alex Ray, Raul Puri, Gretchen Krueger, Michael Petrov, Heidy Khlaaf, Girish Sastry, Pamela Mishkin, Brooke Chan, Scott Gray, and 39 others. 202… — [Evaluating Large Language Models Trained on Code](https://md.research.elamur.ai/free/en/papers/chen-2021-evaluating-large-language-models-trained/)
4. Mike Conover, Matt Hayes, Ankit Mathur, Jianwei Xie, Jun Wan, Sam Shah, Ali Ghodsi, Patrick Wendell, Matei Zaharia, and Reynold Xin. 2023. Free dolly: Introducing the world’s first truly open instruction-tuned llm. [find](https://scholar.google.com/scholar?q=Mike+Conover%2C+Matt+Hayes%2C+Ankit+Mathur%2C+Jianwei+Xie%2C+Jun+Wan%2C+Sam+Shah%2C+Ali+Ghodsi%2C+Patrick+Wendell%2C+Matei+Zaharia%2C+and+Reynold+Xin%2E+2023%2E+Free+dolly%3A+Introducing+the+world%E2%80%99s+first+truly+open+instruct)
5. Yi Ding, Lijun Li, Bing Cao, and Jing Shao. 2025. Rethinking bottlenecks in safety fine-tuning of vision language models. arXiv preprint arXiv:2501.18533. — [arXiv:2501.18533](https://arxiv.org/abs/2501.18533) [find](https://scholar.google.com/scholar?q=Yi+Ding%2C+Lijun+Li%2C+Bing+Cao%2C+and+Jing+Shao%2E+2025%2E+Rethinking+bottlenecks+in+safety+fine%2Dtuning+of+vision+language+models%2E+arXiv+preprint+arXiv%3A2501%2E18533%2E+%E2%80%94+%5BarXiv%3A2501%2E18533%5D%28https%3A%2F%2Farxiv%2Eorg%2Fabs%2F25)
6. Aladin Djuhera, Swanand Kadhe, Farhan Ahmed, Syed Zawad, and Holger Boche. 2025. SafeMERGE: Preserving safety alignment in fine-tuned large language models via selective layer-wise model merging. In ICLR 2025 Workshop on Building Trust in Language Models and Applications. [find](https://scholar.google.com/scholar?q=Aladin+Djuhera%2C+Swanand+Kadhe%2C+Farhan+Ahmed%2C+Syed+Zawad%2C+and+Holger+Boche%2E+2025%2E+SafeMERGE%3A+Preserving+safety+alignment+in+fine%2Dtuned+large+language+models+via+selective+layer%2Dwise+model+merging%2E+In+I)
7. Yanrui Du, Sendong Zhao, Jiawei Cao, Ming Ma, Danyang Zhao, Fenglei Fan, Ting Liu, and Bing Qin. 2024. Towards secure tuning: Mitigating security risks arising from benign instruction fine-tuning. arXiv preprint arXiv:2410.04524. — [arXiv:2410.04524](https://arxiv.org/abs/2410.04524) [find](https://scholar.google.com/scholar?q=Yanrui+Du%2C+Sendong+Zhao%2C+Jiawei+Cao%2C+Ming+Ma%2C+Danyang+Zhao%2C+Fenglei+Fan%2C+Ting+Liu%2C+and+Bing+Qin%2E+2024%2E+Towards+secure+tuning%3A+Mitigating+security+risks+arising+from+benign+instruction+fine%2Dtuning%2E+arX)
8. Hua Farn, Hsuan Su, Shachi H Kumar, Saurav Sahay, Shang-Tse Chen, and Hung-yi Lee. 2024. Safeguard fine-tuned llms through pre-and post-tuning model merging. arXiv preprint arXiv:2412.19512. [find](https://scholar.google.com/scholar?q=Hua+Farn%2C+Hsuan+Su%2C+Shachi+H+Kumar%2C+Saurav+Sahay%2C+Shang%2DTse+Chen%2C+and+Hung%2Dyi+Lee%2E+2024%2E+Safeguard+fine%2Dtuned+llms+through+pre%2Dand+post%2Dtuning+model+merging%2E+arXiv+preprint+arXiv%3A2412%2E19512%2E)
9. Wensheng Gan, Zhenlian Qi, Jiayang Wu, and Jerry Chun-Wei Lin. 2023. Large language models in education: Vision and opportunities. In 2023 IEEE international conference on big data (BigData), pages 4776–4785. IEEE. [find](https://scholar.google.com/scholar?q=Wensheng+Gan%2C+Zhenlian+Qi%2C+Jiayang+Wu%2C+and+Jerry+Chun%2DWei+Lin%2E+2023%2E+Large+language+models+in+education%3A+Vision+and+opportunities%2E+In+2023+IEEE+international+conference+on+big+data+%28BigData%29%2C+pages+47)
10. Leo Gao, Jonathan Tow, Baber Abbasi, Stella Biderman, Sid Black, Anthony DiPofi, Charles Foster, Laurence Golding, Jeffrey Hsu, Alain Le Noac’h, Haonan Li, Kyle McDonell, Niklas Muennighoff, Chris Ociepa, Jason Phang, Laria Reynolds, Hailey Schoelkopf, Aviya Skowron, Lintang Sutawika, and 5 others.… [find](https://scholar.google.com/scholar?q=Leo+Gao%2C+Jonathan+Tow%2C+Baber+Abbasi%2C+Stella+Biderman%2C+Sid+Black%2C+Anthony+DiPofi%2C+Charles+Foster%2C+Laurence+Golding%2C+Jeffrey+Hsu%2C+Alain+Le+Noac%E2%80%99h%2C+Haonan+Li%2C+Kyle+McDonell%2C+Niklas+Muennighoff%2C+Chris+Oci)
11. Haize Labs. 2024. A trivial jailbreak against LLaMA 3. [https://github.com/haizelabs/](https://github.com/haizelabs/) llama3-jailbreak. [↗](https://github.com/haizelabs/)
12. Luxi He, Mengzhou Xia, and Peter Henderson. 2024. What is in your safe data? identifying benign data that breaks safety. In First Conference on Language Modeling. [find](https://scholar.google.com/scholar?q=Luxi+He%2C+Mengzhou+Xia%2C+and+Peter+Henderson%2E+2024%2E+What+is+in+your+safe+data%3F+identifying+benign+data+that+breaks+safety%2E+In+First+Conference+on+Language+Modeling%2E)
13. Dan Hendrycks, Collin Burns, Saurav Kadavath, Akul Arora, Steven Basart, Eric Tang, Dawn Song, and Jacob Steinhardt. 2021. [Measuring mathematical problem solving with the math dataset](https://md.research.elamur.ai/free/en/papers/hendrycks-2021-measuring-mathematical-problem-solving-math/). NeurIPS.
14. Shen Li, Liuyi Yao, Lan Zhang, and Yaliang Li. 2025c. Safety layers in aligned large language models: The key to LLM security. In The Thirteenth International Conference on Learning Representations. [find](https://scholar.google.com/scholar?q=Shen+Li%2C+Liuyi+Yao%2C+Lan+Zhang%2C+and+Yaliang+Li%2E+2025c%2E+Safety+layers+in+aligned+large+language+models%3A+The+key+to+LLM+security%2E+In+The+Thirteenth+International+Conference+on+Learning+Representations%2E)
15. Chia-Yi Hsu, Yu-Lin Tsai, Chih-Hsun Lin, Pin-Yu Chen, Chia-Mu Yu, and Chun-Ying Huang. 2024. Safe lora: The silver lining of reducing safety risks when finetuning large language models. Advances in Neural Information Processing Systems, 37:65072–65094. [find](https://scholar.google.com/scholar?q=Chia%2DYi+Hsu%2C+Yu%2DLin+Tsai%2C+Chih%2DHsun+Lin%2C+Pin%2DYu+Chen%2C+Chia%2DMu+Yu%2C+and+Chun%2DYing+Huang%2E+2024%2E+Safe+lora%3A+The+silver+lining+of+reducing+safety+risks+when+finetuning+large+language+models%2E+Advances+in+Ne)
16. AI @ Meta Llama Team. 2024. [The llama 3 herd of models](https://md.research.elamur.ai/free/en/papers/grattafiori-2024-llama-3-herd-models/). Preprint, arXiv:2407.21783.
17. Xuhao Hu, Dongrui Liu, Hao Li, Xuanjing Huang, and Jing Shao. 2025. [Vlsbench: Unveiling visual leakage in multimodal safety](https://md.research.elamur.ai/free/en/papers/hu-2025-vlsbench-unveiling-visual-leakage-multimodal/). Preprint, arXiv:2411.19939.
18. Shayne Longpre, Le Hou, Tu Vu, Albert Webson, Hyung Won Chung, Yi Tay, Denny Zhou, Quoc V. Le, Barret Zoph, Jason Wei, and Adam Roberts. 2023. [The flan collection: Designing data and methods for effective instruction tuning](https://md.research.elamur.ai/free/en/papers/longpre-2023-flan-collection-designing-data-methods/). In Proceedings of the 40th International Conference on Machine Learning, pa…
19. Tiansheng Huang, Sihao Hu, Fatih Ilhan, Selim Furkan Tekin, and Ling Liu. 2024a. Harmful fine-tuning attacks and defenses for [large language models: A survey](https://md.research.elamur.ai/free/en/papers/minaee-2024-large-language-models-survey/). arXiv preprint arXiv:2409.18169. — [arXiv:2409.18169](https://arxiv.org/abs/2409.18169)
20. Xiaoya Lu, Dongrui Liu, Yi Yu, Luxin Xu, and Jing Shao. 2025. X-boundary: Establishing exact safety boundary to shield llms from multi-turn jailbreaks without compromising usability. arXiv preprint arXiv:2502.09990. — [arXiv:2502.09990](https://arxiv.org/abs/2502.09990) [find](https://scholar.google.com/scholar?q=Xiaoya+Lu%2C+Dongrui+Liu%2C+Yi+Yu%2C+Luxin+Xu%2C+and+Jing+Shao%2E+2025%2E+X%2Dboundary%3A+Establishing+exact+safety+boundary+to+shield+llms+from+multi%2Dturn+jailbreaks+without+compromising+usability%2E+arXiv+preprint+ar)
21. Tiansheng Huang, Sihao Hu, and Ling Liu. 2024b. Vaccine: Perturbation-aware alignment for large language models against harmful fine-tuning attack. In The Thirty-eighth Annual Conference on Neural Information Processing Systems. [find](https://scholar.google.com/scholar?q=Tiansheng+Huang%2C+Sihao+Hu%2C+and+Ling+Liu%2E+2024b%2E+Vaccine%3A+Perturbation%2Daware+alignment+for+large+language+models+against+harmful+fine%2Dtuning+attack%2E+In+The+Thirty%2Deighth+Annual+Conference+on+Neural+Inf)
22. Kaifeng Lyu, Haoyu Zhao, Xinran Gu, Dingli Yu, Anirudh Goyal, and Sanjeev Arora. 2024. Keeping LLMs aligned after fine-tuning: The crucial role of prompt templates. In The Thirty-eighth Annual Conference on Neural Information Processing Systems. [find](https://scholar.google.com/scholar?q=Kaifeng+Lyu%2C+Haoyu+Zhao%2C+Xinran+Gu%2C+Dingli+Yu%2C+Anirudh+Goyal%2C+and+Sanjeev+Arora%2E+2024%2E+Keeping+LLMs+aligned+after+fine%2Dtuning%3A+The+crucial+role+of+prompt+templates%2E+In+The+Thirty%2Deighth+Annual+Confere)
23. Albert Q. Jiang, Alexandre Sablayrolles, Arthur Mensch, Chris Bamford, Devendra Singh Chaplot, Diego de las Casas, Florian Bressand, Gianna Lengyel, Guillaume Lample, Lucile Saulnier, Lélio Renard Lavaud, Marie-Anne Lachaux, Pierre Stock, Teven Le Scao, Thibaut Lavril, Thomas Wang, Timothée Lacroix,… [find](https://scholar.google.com/scholar?q=Albert+Q%2E+Jiang%2C+Alexandre+Sablayrolles%2C+Arthur+Mensch%2C+Chris+Bamford%2C+Devendra+Singh+Chaplot%2C+Diego+de+las+Casas%2C+Florian+Bressand%2C+Gianna+Lengyel%2C+Guillaume+Lample%2C+Lucile+Saulnier%2C+L%C3%A9lio+Renard+Lav)
24. Todor Markov, Chong Zhang, Sandhini Agarwal, Florentine Eloundou Nekoul, Theodore Lee, Steven Adler, Angela Jiang, and Lilian Weng. 2023. [A holistic approach to undesired content detection in the real world](https://md.research.elamur.ai/free/en/papers/markov-2022-holistic-approach-undesired-content-detection/). In Proceedings of the AAAI Conference on Artificial Intelligence, volume 37, pages 15009–150…
25. Qiao Jin, Bhuwan Dhingra, Zhengping Liu, William W Cohen, and Xinghua Lu. 2019. [Pubmedqa: A dataset for biomedical research question answering](https://md.research.elamur.ai/free/en/papers/jin-2019-pubmedqa-dataset-biomedical-research-question/). arXiv preprint arXiv:1909.06146.
26. Divyanshu Kumar, Anurakt Kumar, Sahil Agarwal, and Prashanth Harshangi. 2024. Increased llm vulnerabilities from fine-tuning and quantization. arXiv eprints, pages arXiv–2404. [find](https://scholar.google.com/scholar?q=Divyanshu+Kumar%2C+Anurakt+Kumar%2C+Sahil+Agarwal%2C+and+Prashanth+Harshangi%2E+2024%2E+Increased+llm+vulnerabilities+from+fine%2Dtuning+and+quantization%2E+arXiv+eprints%2C+pages+arXiv%E2%80%932404%2E)
27. Lijun Li, Bowen Dong, Ruohui Wang, Xuhao Hu, Wangmeng Zuo, Dahua Lin, Yu Qiao, and Jing Shao. 2024. [Salad-bench: A hierarchical and comprehensive safety benchmark for large language models](https://md.research.elamur.ai/free/en/papers/li-2024-salad-bench-hierarchical-comprehensive-safety/). arXiv preprint arXiv:2402.05044.
28. Mantas Mazeika, Long Phan, Xuwang Yin, Andy Zou, Zifan Wang, Norman Mu, Elham Sakhaee, Nathaniel Li, Steven Basart, Bo Li, David Forsyth, and Dan Hendrycks. 2024. [Harmbench: A standardized evaluation framework for automated red teaming and robust refusal](https://md.research.elamur.ai/free/en/papers/mazeika-2024-harmbench-standardized-evaluation-framework-automated/). Preprint, arXiv:2402.04249.
29. Ziqi Miao, Yi Ding, Lijun Li, and Jing Shao. 2025a. [Visual contextual attack: Jailbreaking mllms with image-driven context injection](https://md.research.elamur.ai/free/en/papers/ziqi-2025-visual-contextual-attack-jailbreaking-mllms/). arXiv preprint arXiv:2507.02844.
30. Ziqi Miao, Lijun Li, Yuan Xiong, Zhenhua Liu, Pengyu Zhu, and Jing Shao. 2025b. Response attack: Exploiting contextual priming to jailbreak large language models. arXiv preprint arXiv:2507.05248. — [arXiv:2507.05248](https://arxiv.org/abs/2507.05248) [find](https://scholar.google.com/scholar?q=Ziqi+Miao%2C+Lijun+Li%2C+Yuan+Xiong%2C+Zhenhua+Liu%2C+Pengyu+Zhu%2C+and+Jing+Shao%2E+2025b%2E+Response+attack%3A+Exploiting+contextual+priming+to+jailbreak+large+language+models%2E+arXiv+preprint+arXiv%3A2507%2E05248%2E+%E2%80%94+%5Ba)
31. Lijun Li, Zhelun Shi, Xuhao Hu, Bowen Dong, Yiran Qin, Xihui Liu, Lu Sheng, and Jing Shao. 2025a. T2isafety: Benchmark for assessing fairness, toxicity, and privacy in image generation. In Proceedings of the Computer Vision and Pattern Recognition Conference, pages 13381–13392. [find](https://scholar.google.com/scholar?q=Lijun+Li%2C+Zhelun+Shi%2C+Xuhao+Hu%2C+Bowen+Dong%2C+Yiran+Qin%2C+Xihui+Liu%2C+Lu+Sheng%2C+and+Jing+Shao%2E+2025a%2E+T2isafety%3A+Benchmark+for+assessing+fairness%2C+toxicity%2C+and+privacy+in+image+generation%2E+In+Proceedings)
32. Subhabrata Mukherjee, Arindam Mitra, Ganesh Jawahar, Sahaj Agarwal, Hamid Palangi, and Ahmed Awadallah. 2023. [Orca: Progressive learning from complex explanation traces of gpt-4](https://md.research.elamur.ai/free/en/papers/mukherjee-2023-orca-progressive-learning-complex-explanation/). arXiv preprint arXiv:2306.02707.
33. Mingjie Li, Wai Man Si, Michael Backes, Yang Zhang, and Yisen Wang. 2025b. SaloRA: Safety-alignment preserved low-rank adaptation. In The Thirteenth International Conference on Learning Representations. [find](https://scholar.google.com/scholar?q=Mingjie+Li%2C+Wai+Man+Si%2C+Michael+Backes%2C+Yang+Zhang%2C+and+Yisen+Wang%2E+2025b%2E+SaloRA%3A+Safety%2Dalignment+preserved+low%2Drank+adaptation%2E+In+The+Thirteenth+International+Conference+on+Learning+Representation)
34. Wenbo Pan, Zhichao Liu, Qiguang Chen, Xiangyang Zhou, Haining Yu, and Xiaohua Jia. 2025a. The hidden dimensions of llm alignment: A multi-dimensional safety analysis. arXiv preprint arXiv:2502.09674. — [arXiv:2502.09674](https://arxiv.org/abs/2502.09674) [find](https://scholar.google.com/scholar?q=Wenbo+Pan%2C+Zhichao+Liu%2C+Qiguang+Chen%2C+Xiangyang+Zhou%2C+Haining+Yu%2C+and+Xiaohua+Jia%2E+2025a%2E+The+hidden+dimensions+of+llm+alignment%3A+A+multi%2Ddimensional+safety+analysis%2E+arXiv+preprint+arXiv%3A2502%2E09674%2E+)
35. Yijun Pan, Taiwei Shi, Jieyu Zhao, and Jiaqi W Ma. 2025b. Detecting and filtering unsafe training data via data attribution. arXiv preprint arXiv:2502.11411. — [arXiv:2502.11411](https://arxiv.org/abs/2502.11411) [find](https://scholar.google.com/scholar?q=Yijun+Pan%2C+Taiwei+Shi%2C+Jieyu+Zhao%2C+and+Jiaqi+W+Ma%2E+2025b%2E+Detecting+and+filtering+unsafe+training+data+via+data+attribution%2E+arXiv+preprint+arXiv%3A2502%2E11411%2E+%E2%80%94+%5BarXiv%3A2502%2E11411%5D%28https%3A%2F%2Farxiv%2Eorg%2Fabs)
36. Hao Wang, Hao Li, Junda Zhu, Xinyuan Wang, Chengwei Pan, MinLie Huang, and Lei Sha. 2025. Diffu-sionattacker: Diffusion-driven prompt manipulation for llm jailbreak. Preprint, arXiv:2412.17522. — [arXiv:2412.17522](https://arxiv.org/abs/2412.17522) [find](https://scholar.google.com/scholar?q=Hao+Wang%2C+Hao+Li%2C+Junda+Zhu%2C+Xinyuan+Wang%2C+Chengwei+Pan%2C+MinLie+Huang%2C+and+Lei+Sha%2E+2025%2E+Diffu%2Dsionattacker%3A+Diffusion%2Ddriven+prompt+manipulation+for+llm+jailbreak%2E+Preprint%2C+arXiv%3A2412%2E17522%2E+%E2%80%94+%5BarX)
37. Baolin Peng, Chunyuan Li, Pengcheng He, Michel Galley, and Jianfeng Gao. 2023. [Instruction tuning with gpt-4](https://md.research.elamur.ai/free/en/papers/peng-2023-instruction-tuning-gpt-4/). arXiv preprint arXiv:2304.03277.
38. Yuxiang Wei, Zhe Wang, Jiawei Liu, Yifeng Ding, and LINGMING ZHANG. 2024. Magicoder: Empowering code generation with OSS-instruct. In Forty-first International Conference on Machine Learning. [find](https://scholar.google.com/scholar?q=Yuxiang+Wei%2C+Zhe+Wang%2C+Jiawei+Liu%2C+Yifeng+Ding%2C+and+LINGMING+ZHANG%2E+2024%2E+Magicoder%3A+Empowering+code+generation+with+OSS%2Dinstruct%2E+In+Forty%2Dfirst+International+Conference+on+Machine+Learning%2E)
39. Xiangyu Qi, Ashwinee Panda, Kaifeng Lyu, Xiao Ma, Subhrajit Roy, Ahmad Beirami, Prateek Mittal, and Peter Henderson. 2025. Safety alignment should be made more than just a few tokens deep. In The Thirteenth International Conference on Learning Representations. [find](https://scholar.google.com/scholar?q=Xiangyu+Qi%2C+Ashwinee+Panda%2C+Kaifeng+Lyu%2C+Xiao+Ma%2C+Subhrajit+Roy%2C+Ahmad+Beirami%2C+Prateek+Mittal%2C+and+Peter+Henderson%2E+2025%2E+Safety+alignment+should+be+made+more+than+just+a+few+tokens+deep%2E+In+The+Thir)
40. Shijie Wu, Ozan Irsoy, Steven Lu, Vadim Dabravolski, Mark Dredze, Sebastian Gehrmann, Prabhanjan Kambadur, David Rosenberg, and Gideon Mann. 2023. [Bloomberggpt: A large language model for finance](https://md.research.elamur.ai/free/en/papers/wu-2023-bloomberggpt-large-language-model-finance/). arXiv preprint arXiv:2303.17564.
41. Xiangyu Qi, Yi Zeng, Tinghao Xie, Pin-Yu Chen, Ruoxi Jia, Prateek Mittal, and Peter Henderson. 2024. [Fine-tuning aligned language models compromises safety, even when users do not intend to!](https://md.research.elamur.ai/free/en/papers/qi-2023-fine-tuning-aligned-language-models/) In ICLR.
42. Mengzhou Xia, Sadhika Malladi, Suchin Gururangan, Sanjeev Arora, and Danqi Chen. 2024. [LESS: Selecting influential data for targeted instruction tuning](https://md.research.elamur.ai/free/en/papers/xia-2024-less-selecting-influential-data-targeted/). In International Conference on Machine Learning (ICML).
43. Qwen, :, An Yang, Baosong Yang, Beichen Zhang, Binyuan Hui, Bo Zheng, Bowen Yu, Chengyuan Li, Dayiheng Liu, Fei Huang, Haoran Wei, Huan Lin, Jian Yang, Jianhong Tu, Jianwei Zhang, Jianxin Yang, Jiaxi Yang, Jingren Zhou, and 25 others. 2025. Qwen2.5 technical report. Preprint, arXiv:2412.15115. [find](https://scholar.google.com/scholar?q=Qwen%2C+%3A%2C+An+Yang%2C+Baosong+Yang%2C+Beichen+Zhang%2C+Binyuan+Hui%2C+Bo+Zheng%2C+Bowen+Yu%2C+Chengyuan+Li%2C+Dayiheng+Liu%2C+Fei+Huang%2C+Haoran+Wei%2C+Huan+Lin%2C+Jian+Yang%2C+Jianhong+Tu%2C+Jianwei+Zhang%2C+Jianxin+Yang%2C+Jiaxi+)
44. Yueqi Xie, Minghong Fang, Renjie Pi, and Neil Gong. 2024. Gradsafe: Detecting jailbreak prompts for llms via safety-critical gradient analysis. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 507–518. [find](https://scholar.google.com/scholar?q=Yueqi+Xie%2C+Minghong+Fang%2C+Renjie+Pi%2C+and+Neil+Gong%2E+2024%2E+Gradsafe%3A+Detecting+jailbreak+prompts+for+llms+via+safety%2Dcritical+gradient+analysis%2E+In+Proceedings+of+the+62nd+Annual+Meeting+of+the+Associa)
45. Qibing Ren, Hao Li, Dongrui Liu, Zhanxu Xie, Xiaoya Lu, Yu Qiao, Lei Sha, Junchi Yan, Lizhuang Ma, and Jing Shao. 2024. Derail yourself: Multi-turn llm jailbreak attack through self-discovered clues. arXiv preprint arXiv:2410.10700. — [arXiv:2410.10700](https://arxiv.org/abs/2410.10700) [find](https://scholar.google.com/scholar?q=Qibing+Ren%2C+Hao+Li%2C+Dongrui+Liu%2C+Zhanxu+Xie%2C+Xiaoya+Lu%2C+Yu+Qiao%2C+Lei+Sha%2C+Junchi+Yan%2C+Lizhuang+Ma%2C+and+Jing+Shao%2E+2024%2E+Derail+yourself%3A+Multi%2Dturn+llm+jailbreak+attack+through+self%2Ddiscovered+clues%2E+)
46. Domenic Rosati, Jan Wehner, Kai Williams, Lukasz Bartoszcze, Robie Gonzales, carsten maple, Subhabrata Majumdar, Hassan Sajjad, and Frank Rudzicz. 2024. Representation noising: A defence mechanism against harmful finetuning. In The Thirty-eighth Annual Conference on Neural Information Processing Sys… [find](https://scholar.google.com/scholar?q=Domenic+Rosati%2C+Jan+Wehner%2C+Kai+Williams%2C+Lukasz+Bartoszcze%2C+Robie+Gonzales%2C+carsten+maple%2C+Subhabrata+Majumdar%2C+Hassan+Sajjad%2C+and+Frank+Rudzicz%2E+2024%2E+Representation+noising%3A+A+defence+mechanism+aga)
47. Olivier Roy and Martin Vetterli. 2007. The effective rank: A measure of effective dimensionality. In 2007 15th European signal processing conference, pages 606–610. IEEE. [find](https://scholar.google.com/scholar?q=Olivier+Roy+and+Martin+Vetterli%2E+2007%2E+The+effective+rank%3A+A+measure+of+effective+dimensionality%2E+In+2007+15th+European+signal+processing+conference%2C+pages+606%E2%80%93610%2E+IEEE%2E)
48. Han Shen, Pin-Yu Chen, Payel Das, and Tianyi Chen. 2025. SEAL: Safety-enhanced aligned LLM fine-tuning via bilevel data selection. In The Thirteenth International Conference on Learning Representations. [find](https://scholar.google.com/scholar?q=Han+Shen%2C+Pin%2DYu+Chen%2C+Payel+Das%2C+and+Tianyi+Chen%2E+2025%2E+SEAL%3A+Safety%2Denhanced+aligned+LLM+fine%2Dtuning+via+bilevel+data+selection%2E+In+The+Thirteenth+International+Conference+on+Learning+Representation)
49. Rohan Taori, Ishaan Gulrajani, Tianyi Zhang, Yann Dubois, Xuechen Li, Carlos Guestrin, Percy Liang, and Tatsunori B. Hashimoto. 2023. Stanford alpaca: An instruction-following llama model. [https://github.com/tatsu-lab/stanford_alpaca](https://github.com/tatsu-lab/stanford_alpaca). [↗](https://github.com/tatsu-lab/stanford_alpaca)
50. Hao Wang, Hao Li, Minlie Huang, and Lei Sha. 2024. Asetf: A novel method for jailbreak attack on llms through translate suffix embeddings. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, pages 2697–2711. [find](https://scholar.google.com/scholar?q=Hao+Wang%2C+Hao+Li%2C+Minlie+Huang%2C+and+Lei+Sha%2E+2024%2E+Asetf%3A+A+novel+method+for+jailbreak+attack+on+llms+through+translate+suffix+embeddings%2E+In+Proceedings+of+the+2024+Conference+on+Empirical+Methods+in)
51. Longhui Yu, Weisen Jiang, Han Shi, Jincheng Yu, Zhengying Liu, Yu Zhang, James T Kwok, Zhenguo Li, Adrian Weller, and Weiyang Liu. 2023. [Metamath: Bootstrap your own mathematical questions for large language models](https://md.research.elamur.ai/free/en/papers/yu-2023-metamath-bootstrap-your-own-mathematical/). arXiv preprint arXiv:2309.12284.
52. Shengyu Zhang, Linfeng Dong, Xiaoya Li, Sen Zhang, Xiaofei Sun, Shuhe Wang, Jiwei Li, Runyi Hu, Tianwei Zhang, Fei Wu, and 1 others. 2023. [Instruction tuning for large language models: A survey](https://md.research.elamur.ai/free/en/papers/zhang-2023-instruction-tuning-large-language-models/). arXiv preprint arXiv:2308.10792.
53. Yihao Zhang, Zeming Wei, Jun Sun, and Meng Sun. 2024. Adversarial representation engineering: A general model editing framework for large language models. In The Thirty-eighth Annual Conference on Neural Information Processing Systems. [find](https://scholar.google.com/scholar?q=Yihao+Zhang%2C+Zeming+Wei%2C+Jun+Sun%2C+and+Meng+Sun%2E+2024%2E+Adversarial+representation+engineering%3A+A+general+model+editing+framework+for+large+language+models%2E+In+The+Thirty%2Deighth+Annual+Conference+on+Neu)
54. Yiran Zhao, Wenxuan Zhang, Yuxi Xie, Anirudh Goyal, Kenji Kawaguchi, and Michael Shieh. 2025. Understanding and enhancing safety mechanisms of LLMs via safety-specific neuron. In The Thirteenth International Conference on Learning Representations. [find](https://scholar.google.com/scholar?q=Yiran+Zhao%2C+Wenxuan+Zhang%2C+Yuxi+Xie%2C+Anirudh+Goyal%2C+Kenji+Kawaguchi%2C+and+Michael+Shieh%2E+2025%2E+Understanding+and+enhancing+safety+mechanisms+of+LLMs+via+safety%2Dspecific+neuron%2E+In+The+Thirteenth+Intern)
55. Junhao Zheng, Xidi Cai, Shengjie Qiu, and Qianli Ma. 2025. Spurious forgetting in continual learning of language models. In The Thirteenth International Conference on Learning Representations. [find](https://scholar.google.com/scholar?q=Junhao+Zheng%2C+Xidi+Cai%2C+Shengjie+Qiu%2C+and+Qianli+Ma%2E+2025%2E+Spurious+forgetting+in+continual+learning+of+language+models%2E+In+The+Thirteenth+International+Conference+on+Learning+Representations%2E)
56. Weikang Zhou, Xiao Wang, Limao Xiong, Han Xia, Yingshuang Gu, Mingxu Chai, Fukang Zhu, Caishuang Huang, Shihan Dou, Zhiheng Xi, and 1 others. 2024. Easyjailbreak: A unified framework for jailbreaking large language models. arXiv preprint arXiv:2403.12171. — [arXiv:2403.12171](https://arxiv.org/abs/2403.12171) [find](https://scholar.google.com/scholar?q=Weikang+Zhou%2C+Xiao+Wang%2C+Limao+Xiong%2C+Han+Xia%2C+Yingshuang+Gu%2C+Mingxu+Chai%2C+Fukang+Zhu%2C+Caishuang+Huang%2C+Shihan+Dou%2C+Zhiheng+Xi%2C+and+1+others%2E+2024%2E+Easyjailbreak%3A+A+unified+framework+for+jailbreaking+)
57. Yongshuo Zong, Ondrej Bohdal, Tingyang Yu, Yongxin Yang, and Hospedales Timothy. 2024. Safety fine-tuning at (almost) no cost: A baseline for vision large language models. arXiv preprint arXiv:2402.02207. [find](https://scholar.google.com/scholar?q=Yongshuo+Zong%2C+Ondrej+Bohdal%2C+Tingyang+Yu%2C+Yongxin+Yang%2C+and+Hospedales+Timothy%2E+2024%2E+Safety+fine%2Dtuning+at+%28almost%29+no+cost%3A+A+baseline+for+vision+large+language+models%2E+arXiv+preprint+arXiv%3A2402%2E02)
58. Andy Zou, Long Phan, Sarah Chen, James Campbell, Phillip Guo, Richard Ren, Alexander Pan, Xuwang Yin, Mantas Mazeika, Ann-Kathrin Dombrowski, and 1 others. 2023a. [Representation engineering: A top-down approach to ai transparency](https://md.research.elamur.ai/free/en/papers/zou-2023-representation-engineering-top-down-approach/). arXiv preprint arXiv:2310.01405.
59. Andy Zou, Long Phan, Justin Wang, Derek Duenas, Maxwell Lin, Maksym Andriushchenko, Rowan Wang, Zico Kolter, Matt Fredrikson, and Dan Hendrycks. 2024. Improving alignment and robustness with circuit breakers. Preprint, arXiv:2406.04313. [find](https://scholar.google.com/scholar?q=Andy+Zou%2C+Long+Phan%2C+Justin+Wang%2C+Derek+Duenas%2C+Maxwell+Lin%2C+Maksym+Andriushchenko%2C+Rowan+Wang%2C+Zico+Kolter%2C+Matt+Fredrikson%2C+and+Dan+Hendrycks%2E+2024%2E+Improving+alignment+and+robustness+with+circuit+b)
60. Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J Zico Kolter, and Matt Fredrikson. 2023b. [Universal and transferable adversarial attacks on aligned language models](https://md.research.elamur.ai/free/en/papers/zou-2023-universal-transferable-adversarial-attacks-aligned/). arXiv preprint arXiv:2307.15043.

*Updated 31 October 2026*